Because Congress was not convinced that the Trump administration would respond to Russia’s various shenanigans in Ukraine and in the U.S. elections, it passed, on August 2, 2017, the Countering America’s Adversaries Through Sanctions Act (“CAATS Act”). Section 231 of the CAATS Act targets U.S. and foreign persons that engage in a “significant transaction with a person that is part of, or operates for or on behalf of, the defense or intelligence sectors of the Government of the Russian Federation.” Under that section, the President must impose at least five of the laundry list of twelve possible (and familiar) sanctions described in section 235, including denial of export privileges, asset blocking, government procurement bans, visa and travel bans and prohibition of lending to, or investment in, the sanctioned entity. That section also permits these sanctions to be imposed not just on a corporate entity but also on its principal officers.

One immediate and obvious issue is the ban on dealing with persons acting on behalf of Russian intelligence. You don’t have to be an avid fan of “The Americans” or John le Carré to know that spooks don’t ever advertise that they are spooks. Kaspersky Labs, which may or may not be acting on behalf of the FSB, vigorously denies that it has had anything whatsoever, now or in the past, with the FSB, which, of course, is to be expected and is not in and of itself convincing proof that they are just a little anti-virus company in Moscow. So section 231(d) required the President to issue, by October 1, 2017, “regulations or other guidance to specify the persons that are part of, or operate for or on behalf of, the defense and intelligence sectors of the Government of the Russian Federation.” Not surprisingly, October 1, 2017 came and went without the required guidance. Tick. Tock. Tick. Tock.

Well, yesterday, almost a month late and after a draft of the guidance was leaked to the New York Times, the State Department released a list of thirty-nine entities associated with Russian defense and intelligence. Of those, only 10 were not previously on the SDN or SSI Lists. Of the twenty-nine already on one of those lists, eight are on the SSI List.

It is not at all clear why this list and the guidance are being issued from the State Department rather than from the Department of Treasury’s Office of Foreign Assets Control which normally handles economic sanctions of this sort. The result is that Heather Nauert, who held a State Department briefing on the new guidance and admitted that she was not a “sanctions expert,” had no idea what she was talking about. Hilariously (or perhaps tragically) she says that the entities on the list are “entities that [people] can no longer do business with.” The issued guidance says the exact opposite: “The Act does not provide for sanctions in cases in which transactions are not “significant.'” Oops.

Of course, even though the prohibition is only on “significant transactions” with these entities, it is not altogether clear what constitutes a “significant transaction.” Inexplicably, there is no dollar threshold mentioned in the guidance. The most detailed statement on what is not significant is this confusing statement: if a”transaction for goods or services has purely civilian end-uses and/or civilian end-users, and does not involve entities in the intelligence sector,”  this will “weigh heavily against” a determination that it is a significant transaction.  What this says, given that the restrictions are on dealings with the intelligence and defense sectors, is that transactions in the defense sector with purely civilian end-users or civilian end-uses won’t be deemed to be significant transactions. How a transaction in the defense sector can have purely civilian end-uses and end-users is far from clear.

Finally, it is important to understand that nothing in the guidance says that this is a comprehensive list of entities in the defense and intelligence sector where significant transactions can lead to sanctions. If you have a significant transaction with an entity in the intelligence sector, even one operating under deep cover, you and your principal officers can be sanctioned. Whether this will ever happen is unclear, but U.S. and foreign companies doing business with Russian companies will be doing so at their own risk.  Whether this is the intended result or simply an unintended result of incompetence is irrelevant.